Overview
CVE-2025-13445 is a high-severity vulnerability affecting Tenda AC21 routers (version 16.03.08.16). This flaw, a stack-based buffer overflow, can be exploited remotely, allowing attackers to potentially gain unauthorized access and control over the affected device. The vulnerability resides within the /goform/SetIpMacBind file and is triggered through manipulation of arguments.
Technical Details
The vulnerability is a stack-based buffer overflow located in the SetIpMacBind functionality of the Tenda AC21 router firmware. By crafting a malicious argument list and sending it to the /goform/SetIpMacBind endpoint, an attacker can overwrite data on the stack. This can lead to arbitrary code execution, effectively granting the attacker control of the router. The specific input vector causing the overflow involves exceeding the buffer’s capacity when handling parameters related to IP and MAC address binding configurations.
CVSS Analysis
- CVE ID: CVE-2025-13445
- Published: 2025-11-20T15:17:25.480
- Severity: HIGH
- CVSS Score: 8.8
A CVSS score of 8.8 indicates a high-severity vulnerability. This score takes into account factors such as the attack vector (network), attack complexity (low), privileges required (none), user interaction (none), scope (changed), confidentiality impact (high), integrity impact (high), and availability impact (high). The remote exploitability and lack of required privileges contribute significantly to the high score.
Possible Impact
Successful exploitation of CVE-2025-13445 can have severe consequences:
- Remote Code Execution: Attackers can execute arbitrary code on the router, potentially gaining full control of the device.
- Data Exfiltration: Sensitive information, such as network credentials and user data, could be stolen.
- Denial of Service (DoS): The router could be rendered unusable, disrupting network connectivity.
- Malware Propagation: The compromised router could be used as a launching pad for further attacks on other devices on the network.
- Botnet Recruitment: The router could be recruited into a botnet, participating in distributed attacks.
Mitigation and Patch Steps
The primary mitigation strategy is to apply the latest firmware update provided by Tenda. Users should:
- Check the Tenda support website ( https://www.tenda.com.cn/ ) for available firmware updates for the AC21 model.
- Download and install the latest firmware following the instructions provided by Tenda.
- If a patch is not yet available, consider disabling remote administration access to the router as a temporary workaround.
- Monitor network traffic for suspicious activity that might indicate exploitation attempts.
